EH&S Leadership At All Levels

It Starts With You

Workshop Pre-Reading

The Fatal Flaw In Flight 51-L

Contents

Instructions 3 Study Questions 3

The Fatal Flaw In Flight 51-L 5 Challenger's final hours 6 The history of the flawed joint 7 Certified in spite of the flaws 8 Accepted as acceptable 9 The lesser of two evils 9 The problems grow worse 9 Anatomy of a tragedy 10 Why wasn't the design fixed? 11 Why wasn't erosion seen as a danger sign? 11 Operational and then what? 12 Why no second sources? 12 How did NASA and Thiokol view the odds? 12 What role did NASA's safety office play? 13 Was NASA or Thiokol pressured to launch? 14 Why didn't they talk to each other? 14 How about NASA's past success? 15 What lessons have been learned? 15

Defining terms 16

Figures Figure 1: The Launch Decision Chain 17 Figure 2: Anatomy Of A Booster Field Joint 18 Figure 3: Joint Rotation 18 Figure 4: Titan Joints vs. Shuttle Booster Joints 19 Figure 5: Joint Putty 19 Figure 6: O-Ring Distress 20 Figure 7: Joint Distress vs. Temperature At Launch 20 Figure 8: 7/31/85 Memo, Boisjoly 21 Figure 9: 10/1/85 Memo, Ebeling 22 Figure 10: 10/1/85 Memo, Stein 24 Figure 11: 10/4/85 Activity Report, Boisjoly 25

Instructions

On the first day of the workshop, we will discuss the management system failures associated with the Space Shuttle Challenger explosion. Please read the attached article[?],[?] before the workshop and be prepared to discuss the study questions listed below.

Study Questions

| |Media reports at the time typically implicated individual managers within the launch decision chain as single points of failure. |
| |Others have described Challenger as a long lead-time, incremental descent into poor judgment. |
| |Would you consider this accident a single failure in approving the launch, or an incremental descent into failure? Why? |
| | |
| |NASA’s Larry Mulloy stated that one lesson he took away from the Challenger disaster was to “be very, very careful when a component is |
| |not operating as designed. Be careful in rationalizing the acceptance of anomalies you didn’t expect.” What anomalies (deviations |
| |from normal or expected performance) in your own facility or organization have been accepted as normal? |
| | |
| |Marshall and NASA expectations for data analysis were that it meet “the strictest standards of scientific positivism. Observational |
| |data, backed by intuitive argument, were unacceptable. Arguments … not supported by data did not meet standards...” |
| |Based only on the information available at the time, how conclusive was the data with respect to O-ring blow-by at temperatures below |
| |53º F? |
| | |
| |What advice would you give someone facing a decision based on inadequate or incomplete information? |
| | |
| |For as many ways as there are to communicate, there are as many opportunities for communication failures. |
| |Consider communication using the written word. What concerns, if any, do you have with the memos included in this case study? What |
| |advice would you give the authors? |
| | |
| |Consider the verbal communications: Mulloy’s “my God, Thiokol, when do you want me to launch, next April”; Hardy’s “I’m appalled”; and|
| |Mason’s “Take off your engineering hat and put on your management hat.” What messages did these comments convey? What phrases in your|
| |own organization might send unintended signals? Please provide examples. How can you ensure your verbal communications send the right|
| |signals? |
| | |
| |The launch decision was made via telephone conference. Technology can be both a help and a hindrance to communication. What are the |
| |advantages to virtual versus face to face communication? The disadvantages? What are some techniques that could be used to overcome |
| |the disadvantages? |
| | |
| |Actions also communicate expectations and priorities. In their book, Execution, Larry Bossidy and Ram Charan state that “The culture of|
| |a company is the behavior of its leaders. Leaders get the behavior they exhibit and tolerate.” What behaviors should a leader |
| |demonstrate to ensure priorities and expectations are clearly understood? What steps should a leader take when conflicts in priority |
| |do arise? |
| | |
| |During the Morton-Thiokol off-line caucus, Thiokol managers made a “management decision” to reverse Thiokol’s original no-launch |
| |recommendation. In arriving at that decision, Mason (Senior Vice-President, Wasatch Division) did not poll the engineers and polled |
| |Robert Lund (Vice-President of Engineering) last. |
| |Can knowing another person’s decision influence your own? |
| | |
| |What can a leader do to ensure all opinions are considered prior to an important decision? |
| | |
| |Diane Vaughan writes that “collective blindness is possible in an organization where change is introduced gradually, routine is |
| |necessary to accomplish tasks, problems are numerous and systems are complex.” |
| |What types of “blindness” might be exhibited within an organization such as Dow? By individuals? |
| | |
| |What can an organization do to overcome “blindness”? |
| | |
| |What type of “collective blindness” was exhibited in the Challenger Launch decision? |
| | |

The Fatal Flaw In Flight 51-L

Trudy E. Bell Senior Associate Editor
Karl Esch Elkridge, Md.

“Decision making does not occur in a vacuum... norms — cultural beliefs and conventions originating in the environment — create routine, taken-for-granted scripts that become part of the individual worldview... invisible rules for behavior (norms) penetrate the organization as categories of structure, thought, and action that shape choice in some directions rather than others.”

Diane Vaughn, 1996

© 1987 IEEE. Reprinted with permission from IEEE Spectrum: 24(2): 36-51. February 1987.[?] [?]

Roger M. Boisjoly strode angrily down the hall to his office. An engineer with Morton-Thiokol Inc.’s Wasatch division, Boisjoly was on the team behind the solid-fuel rocket boosters used for all space shuttle lift-offs.

“The propellant experts had predicted that if we had a leaking seal, (it) would blow up on ignition. At the one minute mark, (another engineer) leaned over and said he had just completed a prayer for thanks for a successful launch. He was settling back in his chair when the thing splattered all over the sky. We all sat stunned. After three or four minutes, I got up and went straight to my office. I sat in my chair, feet up on the desk, staring at the wall. Later, two colleagues stopped in to ask some questions. I couldn’t answer. Nobody else came by for the rest of the day, nor did I go talk to anybody — I just couldn't.”

Roger Boisjoly

He passed the open door of the company's management information center, where colleagues were waiting to watch the launch the morning of Jan. 28, 1986. One caught Boisjoly in the hallway. "Come on, Roger. Come on in and watch." He shook his head. The night before he and a handful of other engineers had done their best to have the launch postponed, and he still felt drained and frustrated.

Still, on that urging, he turned reluctantly into the room. A few moments later, he was watching as Challenger vanished into a fireball, and saw on the screen the rain of fragments dropping toward the Atlantic, nine miles below.

Challenger was destroyed after hot propellant gases blew past the aft joint of the launch vehicle's right booster, burnt through two quarter-inch diameter, synthetic rubber seal rings — called O-rings — and vaporized the seal. It was exactly what Boisjoly and his group had feared might happen.

Challenger's final hours

George Hardy, who stated (in the teleconference) he was “appalled”, also said in the next breath that he “would not recommend launch against the contractor’s objection”. He later added “for God’s sake, don’t let me make a dumb mistake” — but this comment did not carry over the teleconference loop.

From Diane Vaughan, 1996

MONDAY, JAN. 27, 2 PM., EST. The Challenger launch suffered its 4th postponement, this time to the following morning. The weather forecast was clear and cold, with an overnight low of 18º F. The team talked over the possibility of ice in the trough below the launch pad. Commercial antifreeze was added to the water.

2:30 PM. NASA asked Morton-Thiokol to have its engineers review the cold's possible effects. Boisjoly, Arnold R. Thompson, a supervisor for the booster cases, and three other Thiokol engineers firmly believed that the cold could render the O-rings so stiff that they could not properly seal the joints against the hot gases.

8:45 PM. A teleconference began among 34 engineers and managers from NASA and Thiokol, including the principal figures in the launch decision chain. Boisjoly and Thompson showed charts of the history of O-ring erosion and blow-by for the field joint's primary seals. Boisjoly, a specialist in the seals, said his calculations indicated that cold made the rubber rings stiffer and harder, to the point where below freezing, squeezing the O-rings into the gap would be like trying to shove in a brick.

They had photographs of O-rings from previous flights showing that the gases had eroded deeply into the primary O-rings, and that the colder the weather, the worse the gas blow-by. They pointed out that the worst blow-by — one so serious that it indicated the joint had not sealed at all — had taken place on a launch in January 1985, when the O-rings' temperature had been 53º F.

Mulloy asked Thiokol management for a recommendation. Joe C. Kilminster, the company's vice president for the shuttle boosters, said that based upon what his engineers said, he could not recommend a launch at a temperature below their experience limit — in other words, below 53º F.

At that, George B. Hardy, NASA’s deputy director of science and engineering at Marshall, exclaimed that he was "appalled." Reinartz said that he thought the booster was qualified for a launch at any temperature from 40 to 90º F. Mulloy pointed out that no launch-commit criterion had ever been set for the booster joint's temperature "The eve of a launch," he exclaimed, "is a hell of a time to be inventing new criteria." Mulloy was later quoted by some of those present to have remarked: "My God, Thiokol, when do you want me to launch, next April?"

Kilminster quickly responded by asking for a five-minute caucus for the Thiokol personnel, off the teleconference.

10:30 PM. The Thiokol caucus plant lasted closer to 30 minutes. As soon as the telephone connection was cut, Thiokol's general manager said: "We have to make a management decision."

Thompson drew a sketch, illustrating again why he believed cold threatened the sealing of the joints. Boisjoly had photographs of joints showing black soot where hot gases had blown through. He implored them not to ignore the implications of those pictures: that the joints seemed less likely to seal in cold weather. But eventually both men realized they had done everything they could. No one was listening; they went back to their seats.

After that, Thiokol’s top management held a final review. Kilminster and Robert K. Lund, vice president of engineering, were still reluctant to go against the engineers’ objections. But Jerald E. Mason, vice president of Wasatch operations, urged Lund: “Take off your engineering hat and put on your management hat.” At last they all agreed that the joint’s design left enough margin for three times the erosion experienced by the primary O-ring in the previous worst case, and still leave enough rubber to seal the joint. And in any case, the managers agree, even if the primary O-ring did not seal, the secondary would.

11:00 PM. Resuming the teleconference, Kilminster said Thiokol had reassessed the situation; that the effect of temperature gave grounds for concern, but that available data were inconclusive as to how serious the concern should be. Kilminster said Thiokol recommended launching, and read a rational that essentially repeated that used in accepting risks on previous launches.

Hardy at Marshall asked that the written recommendation be faxed to the Kennedy Space Center and to Marshall.

During the off-line caucus, there seemed to be consensus among Marshall managers that Thiokol would stick to their no-launch position. Marshall managers were already discussing who to call to shut the launch down. But this conversation did not take place on the teleconference, so participants in Utah heard no support for their position before going off-line. What Thiokol participants did hear were statements in favor of launch from three Project Managers — Hardy, Mulloy and McDonald.

From Diane Vaughan, 1996

Meanwhile, at Kennedy Space Center, Thiokol's Allan J. McDonald argued with NASA managers that while he too was unconvinced about the effect of low temperature on the O-rings, two other conditions should be enough to call off the launch: first, thick ice on the launch pad (a result of a plan to keep pipes from freezing by allowing water to flow) might shake loose during the launch and be sucked into the main engines or chip the orbiter's heat-protection tiles; second, the stormy Atlantic was so treacherous that ships sent out to recover the boosters were already heading back to shore and would not be in position to retrieve them, which could result in the loss of equipment worth some $50 million. McDonald was advised that none of that was his concern, that NASA and the appropriate contractors were aware of the situation, and that Aldrich would be told about it.

11:30 PM. Mulloy and Reinartz told Aldrich that Thiokol had recommended a launch. They discussed briefly the ice on the launch pad and the status of the recovery ships, but Aldrich later said he was not told about the concern over the O-rings.

11:39 PM. In Houston, the mission evaluation room manager at Johnson Space Center's shuttle mission control center requested permission from Houston's flight-control team to waive the 31º F lower limit on the shuttle's overall launch-commit criterion if the morning turned out to be colder than that. Half an hour later the flight director agreed; no limitations were identified on any system.

TUESDAY, JAN.28, 6:54 AM. A team of technicians charged with checking ice conditions, out on its second inspection of the launch pad, spontaneously decided to measure the temperatures on the solid-fuel rocker boosters (among other parts of the shuttle) with an infrared pyrometer. The right booster registered 8º F near the aft joint, which did not concern the ice team because no launch-commit criterion had been set for the booster's surface temperatures. The team did not report its finding.

8:30 AM. Challenger's crew were strapped into their seats.

9:00 AM. The mission management team decided to go ahead with the launch. No one brought up any doubts about the effect of cold on the O-ring seals.

11:23 AM. The flight director in Houston gave the final "Go ahead" for launch at Kennedy.

11:38 AM. Flight 51-L, carrying Challenger, lifted off Launch Pad 39K. The ambient temperature was 36º F.

11:39 AM. Challenger was destroyed: all seven on board died.

The history of the flawed joint

Thiokol's engineers had based their design for the shuttle boosters on the Air Force's Titan III rocket, a segmented booster widely regarded in the industry as one of the most reliable ever produced. Thiokol hoped that borrowing from that design would result in Titan reliability while speeding up the development program and cutting costs.

Tests of the booster motor began in the mid-1970s. In 1977 Thiokol carried out a hydroburst test to assess the safety margin in the design of the steel case segments.

An entire segment — 12 feet (3.7 meters) in diameter by 26½ feet (8.1 meters) long — was placed in an explosion-proof chamber and filled with oil. The oil was pressurized to 1500 pounds per square inch (10.3 million pascals) — about 1½ times the maximum expected operating pressure at ignition. The engineers attached instruments to a leak-check test port to measure the increase in pressure between the two O-rings.

The hydroburst test demonstrated that the case met its strength requirement. The O-ring measurements showed, however, that the tang and the clevis's inner flange bent away from instead of toward each other. In the first milliseconds after ignition this action reduced, rather than increased, compression of the O-rings. This phenomenon came to be known as joint rotation. Although Thiokol reported those tests to NASA's program office at Marshall, no more tests were scheduled to check the joint's behavior.

NASA engineers were alarmed, however, and on Sept 2, 1977, Glenn Eudy, chief engineer at Marshall for the solid-fuel rocket motors, wrote a memo to the director of the center's structures and propulsion laboratory. Eudy pointed out that the clearance between the tang and clevis — increased from Titan to allow easier assembly of the shuttle boosters — was excessive, and did not allow enough squeeze on the O-rings to ensure their sealing. While "some people believe this deficiency must be corrected by some method such as shimming," Eudy wrote, “I personally believe that our first choice should be to correct the design”

Another Marshall engineer, William Leon Ray, wrote a report on Oct 21, 1977, titled "Solid Rocket Motor Joint leakage Study.” Ray stated that making no change in the Thiokol design was "unacceptable" and that he viewed redesigning the tang to reduce tolerance on the clevis as the "best option for a long-term fix."

After reading Ray's report, John Q. Miller, chief of Marshall's solid-fuel rocket motor branch, signed a memo to Eudy, actually written by Ray, which pointed out that joint rotation at ignition could be enough to separate the O-rings from the tang altogether, breaking the seal. "We see no valid reason for not redesigning [the joint]." At the very least, the memo read, shims were "mandatory to prevent hot gas leaks and resulting catastrophic failure." Miller and Ray both recommended redesign of the joints.

“Decisions trickled down through the organization, altering both the structure and culture of the organization, affecting risk assessments made at the bottom of the hierarchy.”

Diane Vaughan, 1997

But ten months later, on Nov 7, 1978, Edward 0. Dorsey, Thiokol's vice president and space-booster program manager, wrote to George B. Hardy, then Marshall's solid-fuel rocket booster program manager, stating that, based on static-test data, "the extrusion data... have confirmed the capability of the O-rings to prevent leakage under the worst hardware conditions."

But Miller and Ray still disagreed. Moreover, they were uneasy about receiving no reply to their memo to Eudy a year earlier. On Jan 19, 1979, they wrote Eudy again, with a copy to Hardy, beginning: "We find the Thiokol position regarding design adequacy of the clevis joint to be completely unacceptable." They pointed out that joint rotation caused the primary O-ring to extrude into the gap, "which violates industry and government practices, which call for O-rings to seal by compression, not extrusion.” Joint rotation, they noted, allowed the secondary O-ring to become “disengaged from its sealing surface." They also observed that Thiokol's contract called for all high-pressure case seals to be verifiable yet, "the clevis joint secondary O-ring has been verified to be unsatisfactory."

Certified in spite of the flaws

Thiokol, meanwhile, had begun the first phase toward certifying the boosters for flight. Its report, “Phase 1 Design Certification Review,” of March 23, 1979, mentioned leakcheck failures, as well as forces while assembling the joints that resulted in the O-ring grooves in the clevis not conforming to the tang's sealing surfaces. Those observations, however, were not listed as problems, nor were they classified as likely to cause the joint to fail. Furthermore, the March 23 report made no mention that their static tests of a full-up booster in July 1978 had confirmed calculations and hydroburst tests showing that joint rotation caused the tang and clevis to open up and jeopardized the joint's sealing. The Thiokol report, instead, questioned the validity of those measurements.

In 1980, a NASA committee for verifying and certifying the shuttle's flightworthiness reviewed Thiokol's tests and expressed concern about leak-check failures and the integrity of a zinc chromate, asbestos-filled putty. The putty was meant to provide a thermal barrier protecting the O-rings from the hot combustion gases The committee recommended more tests by NASA on the field joint, including tests with the motor fired over a range of propellant mean bulk temperature from 40 to 90º F.

In September 1980, the final report of the verification-certification committee stated that the original hydroburst tests, along with lightweight case tests under way at the time, satisfied the recommendations. “NASA specialists have reviewed the field joint design, updated with larger O-rings and thicker shims,” the final report said, “and found the safety factors to be adequate for the current design.” The joint, added the report, had been “sufficiently verified with the testing accomplished to date.”

Space shuttle Columbia soared aloft on its maiden flight on April 12, 1981, returning triumphantly two days later and showing none of the anticipated field-joint problems. On Columbia's second flight on Nov 12, however, motor gases melted and vaporized the primary O-ring on the right booster's aft field joint to a depth of 0.053 in — about one-fifth of the O-ring's diameter.

But the joint's design made no allowance at all for such erosion. With the putty, the O-rings were, in fact, not even designed to be exposed to the motor gases. Nevertheless, that erosion on the shuttle's second flight was not discussed at flight-readiness reviews for Columbia's third flight, in March 1982, nor was it mentioned at the Level I review for NASA’s associate administrator of space flight, then Air Force Major General James A. Abrahamson. Furthermore, it was not reported by the Marshall problem-assessment system, nor was it given a tracking number.

The first O-ring problems to cause real alarm happened Feb. 3, 1984, on the 10th shuttle flight, when O-rings on both nozzle joints showed erosion. Thiokol reported this at an early flight-readiness review for the next flight. Field-joint erosion & heat damage on previous flights were then brought up for the first time at a flight-readiness review.

Accepted as acceptable

The Marshall problem-assessment system report on the mission noted: "Remedial action — none required," and added, "Possibility exists for some O-ring erosion on future flights." Thiokol ran a computer analysis based on empirical data from subscale tests that indicated that O-rings would still seal even if eroded by as much as 0.09 inch — nearly one-third of their diameter. "Therefore," Thiokol reported, "this is not a constraint to future launches." That view led Mulloy to introduce the concept that a certain amount of erosion was actually "acceptable," along with the notion that the O-rings carried a margin of safety.

However, beginning in April 1984, engineers began to keep a sharper eye on the O-ring problems. On 13 of the 16 flights before the Challenger disaster, up to four of the 16 primary and secondary O-rings on all field and nozzle joints of both boosters suffered some thermal distress. The erosion was also seen to be increasing in depth.

MuIIoy's flight-readiness briefings throughout 1984 and 1985 showed Thiokol and NASA becoming more and more confident. At the Level 1 review for the 13th flight on Sept 26, 1984, Mulloy referred to "allowable erosion." At a meeting on Feb.12, 1985, Mulloy and Thiokol personnel spoke of the observed blow-by of O-rings in two field joints on the 15 flight (STS 51-C) as "acceptable risk."

Beginning with the ninth shuttle flight, Thiokol and NASA engineers changed the leak check during assembly to ensure that the putty did not mask a defective O-ring. The test consisted of applying nitrogen through the small port to pressurize a narrow cavity between the two O-rings.

At the relatively low pressure of 50 pounds per square inch, there was no certainty whether the O-rings were really doing their job. The only evident remedy was to increase the pressure of the leak check on subsequent flights.

The disadvantage of this procedure was that the leak check created blowholes — averaging an inch across — that would not close up again in the weeks between the leak-check test and the actual launch. The blowholes left a path for a jet of hot gas to reach the O-rings, which guaranteed some thermal distress, though not necessarily erosion. On the other hand, blowholes also guaranteed that the O-ring cavity would be pressurized quickly upon ignition.

The lesser of two evils

Thiokol and NASA engineers thus made a conscious, lesser-of-two-evils choice in increasing the leak-check pressure from 50 to 100 lb/in2, beginning with flight STS-9, and to 200 lb/in2 beginning with the 16th flight (STS 51-D).

With the increase in leak-check pressure — first in the nozzle joints and then in the field joints — the incidence of observed O-ring problems in the nozzle joints increased from 12 percent for the first eight flights, where leak-check pressure was 50 lb/in2, to 56 percent for the next seven flights, where pressure was 100 Ib/in2, to 88 percent for the last 10 flights, with a test pressure of 200 lb/in2.

After an April 6, 1984, flight, reports of primary seal erosion caused Mulloy to raise the matter at a flight-readiness review. Deputy administrator at the time, Hans Mark, asked Mulloy to conduct a "formal review of the solid rocket motor case-to-case and case-to-nozzle joint sealing procedures."

Mulloy passed the request to Kilminster at Thiokol on April 13. On May 4, Thiokol proposed a plan for tests to isolate the joint problem and eliminate damage to the O-rings. On May 23, Marshall engineer John Q. Miller approved the plan, supplementing it and expressing continued concern about the putty performance. Miller copied Hardy, Mulloy, Ben Powers, Ray, and several other Marshall engineers.

Nearly a year passed. On April 4, 1985, Kilminster was sent a second request, after which an unofficial seal task force was set up that devised 43 alternative designs for the field joints and 20 for the nozzle joints. The alternatives were presented on August 19. Up to then, however, NASA had allowed Thiokol to continue making boosters without the evaluation called for 14 months earlier.

The problems grow worse

Meanwhile, the worst seal failure yet took place on Challenger’s seventh flight, launched April 29, 1985. The primary O-ring on one nozzle joint eroded away by 0.171 in, two-thirds of its diameter, while the secondary ring was eroded by 0.032 in — the first instance of erosion to a secondary O-ring. Soot and grease on the booster showed that hot gases had blown past the primary seal in the nozzle joint, indicating that for some two minutes into the flight the O-rings had not sealed at all.

At a Level I flight-readiness review on July 2, 1985, Mulloy presented earlier nozzle-joint erosion problems as "closed," and presented for the first time a rationale for accepting such erosion on secondary as well as primary O-rings. "In retrospect," Mulloy said later, "that is where we took a step too far in accepting the risks."

By Dec. 4, 1985, after the 23rd flight, Mulloy noted that the "SRM joint O-ring performance [was] within [our] experience base." He later said that "since the risk of O-ring erosion was accepted and expected, it was no longer an anomaly to be resolved before the next flight."

By Jan 23, 1986 — five days before Challenger's fatal flight — the entire problem of erosion to both nozzle joints and the field joints had been officially closed out in Marshall's problem-reporting system at the request of Allan J. McDonald, Thiokol's solid-fuel rocket motor manager.

In 1980, the booster joint was classified on the shuttle's critical items list as Criticality IR, defined as "redundant hardware, total element failure of which could cause loss of life or vehicle." NASA viewed the joint as redundant because the secondary O-ring was expected to pressurize and seal if the primary did not.

“Each of (the decisions about acceptability of the O-ring risks), taken singly, seemed correct, routine, and indeed, insignificant and unremarkable, but they had a cumulative directionality, stunning in retrospect.”

Diane Vaughan, 1997

In May 1982, however, after high-pressure O-ring tests and tests of a new lightweight motor case, Marshall had accepted the conclusion that joint rotation could prevent the secondary O-ring from sealing. As a result, in December 1982, the joint was reclassified to Criticality 1 "due to possibility of loss of sealing at the secondary O-ring because of joint rotation after motor pressurization." The failure effect: "Actual Loss — Loss of mission, vehicle and crew due to metal erosion, burn through, and probable case burst resulting in fire and deflagration."

The rationale for retaining the Thiokol joint design — written by a Thiokol engineer and attached to the critical items list explained that "the joint concept is basically the same as the single O-ring joint successfully employed on the Titan Ill Solid Rocket Motor." While the rationale cited the Titan's excellent history, leak and hydroburst tests, and static motor firings, it also noted that test results indicated "that the tang-to-clevis movement (joint rotation) will not unseat the secondary O-ring at operating pressures."

Anatomy of a tragedy

Six days after the Challenger disaster, on Feb 3, 1986, President Reagan appointed a commission and charged it with reviewing the accident's circumstances, determining its probable cause, and recommending measures toward preventing another such disaster. Known as the Rogers commission after its chairman, former Secretary of State William P. Rogers, it had 120 days to work.

On June 6, the commission announced its conclusion: The physical cause of Challenger's destruction was "a failure in the joint between the two lower segments of the right Solid Rocket Motor," the report said. "The specific failure was the destruction of the seals intended to prevent hot gases from leaking through the joint during the propellant burn.”

But contributing to the accident, in the commission's now-famous words, was that "the decision to launch the Challenger was flawed." "Those who made that decision were unaware of the recent history of problems concerning the O-rings and the joint and were unaware of the initial written recommendation of the contractor advising against the launch at temperatures below 53 deg F and continued opposition of the engineers at Thiokol after management reversed its position." It faulted the management structure of both Thiokol and NASA for not allowing such information to flow to the people who needed to know it.

After the Rogers commission report was released, the U.S. House of Representatives' Committee on Science and Technology spent two months conducting its own hearings. While they agreed with many of the Rogers commission's conclusions, they also stated that "the fundamental problem was poor technical decision-making over a period of several years by top NASA and contractor personnel."

The House committee pointed out that “information on the flaws in the joint design and on the problem encountered in prior missions was widely available and presented to all levels of Shuttle management." But "The NASA and Thiokol technical managers failed to understand or fully accept the seriousness of the problem. There was no sense of urgency on their part to correct the design flaws. No one suggested grounding the fleet... Rather NASA chose to continue to fly with a flawed design and to follow a measured, 27-month corrective program," leading to a new type of joint proposed for later missions — the capture joint. The committee concluded that the problem surrounding the field-joint O-rings had been recognized soon enough for it to have been corrected, but that no correction was made, because "meeting flight schedules and cutting cost were given a higher priority than flight safety."

Both findings suggest a fundamental question that neither investigation addressed: how could NASA — an organization with a reputation for ingenuity, good design, meticulous engineering, reliability, and safety — have found itself in a position where it repeatedly overlooked the obvious until disaster struck?

Why wasn't the design fixed?

Design of the joint was not changed, say Thiokol and NASA engineers and managers, because it was assumed the joint would behave like the similar joints on the Titan boosters. "In an overall sense," said Thiokol's Joe Kilminster, "the comfort zone was expanded because the shuttle joint was so similar to the Titan joint, and its many uses had shown successful operation. That's why a lot of — I guess 'faith' is the right word — was based on the fact that the Titan had had all these tests and successful experience."

NASA and MTI engineers were working in an organization culture where having problems was expected ... this contributed to the normalization of deviance... what, in retrospect, appeared to be clear signals of potential danger were interpreted differently at the time... because the signals were ...
1. mixed (a signal of danger was followed by one that all was well),
2. weak (a signal is unclear or seems improbable), or
3. routine (a signal occurs frequently).

From Diane Vaughan, 1996

The shuttle booster used O-rings made of the same synthetic rubber, Viton, as the Titan, having essentially the same cross-section size. Even though Titan O-rings had shown signs of erosion, the defect "was relatively localized and not significant enough to defeat the O-ring," Kilminster said. "We felt we could only be in a more safe condition having two O-rings there than with a single O-ring."

Kilminster said that both Thiokol and NASA believed that having the two seals created redundancy. It was recognized, however, that on rare occasions tolerances between two segments might combine so that "the secondary seal would not be in contact with the adjoining face, that was the basis upon which the [Criticality] 1R was changed to 1," he said. "However, it had to be a worst-case stack-up of tolerances, which statistically you would not expect.” Thus even after the joint had been reclassified as Criticality 1, many still believed the joints had redundancy.

Furthermore, Boisjoly pointed out: "The working troops — and I consider myself one of the working troops — had no knowledge of the thing being changed to a Criticality 1. So far as we were concerned, we had two seals that were redundant.... So either you believe that and you fly, or you don't believe it and shut the program down."

Why wasn't erosion seen as a danger sign?

By 1985, erosion and blow-by had come to be accepted as normal — to the point where, in one Level I flight-readiness review, NASA’s Mulloy noted there were "no flight anomalies" and "no major problems or issues," even though there had been erosion or blow-by in three joints. Although some engineers were beginning to be alarmed about the frequency of the erosion — especially after analysis of STS 51-B in April 1985 disclosed that the secondary O-ring of a nozzle joint had been eroded — they received little support from NASA or Thiokol.

In July 1985, for example, Thiokol's unofficial task force was told to solve the O-ring erosion problems for both the short and long term. But in a memorandum of July 31 [Fig.8], Boisjoly noted the group's "essential nonexistence" and asked that it be officially endorsed. He wrote that the consequences of not dealing with the seal problems "would be a catastrophe of the highest order — loss of human life."

Unofficial status notwithstanding, the team came up with 43 new designs for the field joint and 20 more for the nozzle joint. On Aug19 and 26, Thiokol presented its assessment of O-ring seal problems, along with the 63 new joint designs. The next day Thiokol instituted its Nozzle O-ring Investigation Task Force.

By October, however, one task-force member was dismayed enough to write a note to Allan McDonald [Fig. 9]: "HELP! The seal task force is constantly being delayed by every possible means... This is a red flag." And around the same time Boisjoly went to Kilminster and, as he now recalls, "pleaded for help." Boisjoly describes, in his weekly activity report of Oct 4, 1985 [Fig. 11], his problem in obtaining support from Kilminster. "I was really ticked because we were pleading for help and we couldn't get it." Kilminster, Boisjoly says "just didn't basically understand the problem. We were trying to explain it to him, and he just wouldn't hear it. He felt, I guess, that we were crying wolf."

Operational and then what?

For the shuttle to go operational in November 1982, some practical changes had to be made. To handle payloads, original orbiter crews of two astronauts now ranged in size from four to seven. Ejection seats installed for the test flights were removed. Procedures in refurbishing and processing the orbiters and the boosters after each launch, were streamlined in the interests of productivity, as were the routines for reporting problems.

The goal of being operational also changed NASA's philosophy on crew safety. From a 1985 report produced by Rockwell International: "It is interesting to trace the evolution of crew safety philosophy (from Apollo through shuttle). The emphasis has gone historically in two directions: (1) a tendency to go from escape and rescue measure (e.g. abort systems) to obtaining inherent safety (i.e., reduce / eliminate threats): and (2) an increasing interest in saving not only the crew, but also the valuable space systems."

This emphasis on eliminating or controlling threats rather than escaping from them is consistent with airline mentality. "You don't put parachutes on airliners because the margin of safety is built into the machine," said Borman, former president of Eastern Airlines. But, he pointed out, "airplanes are proven vehicles with levels of safety and redundancy built in - levels” he said, “that the space shuttle comes nowhere near to.”

Nevertheless, people both within and outside NASA began to treat the shuttle like an airplane, with an attendant psychological casualness about its mechanical safety.

Why no second sources?

From the start of the shuttle program, other manufacturers had been after NASA to let them be second sources for the boosters, the largest market anywhere for solid-fuel rocket motors. Congress had also wanted a second source, for national security reasons, so that the shuttles would be available for military payloads in the event of a work stoppage or accident at Thiokol.

"NASA had declined to open the bidding because it didn't want to provide the other competitors with what is known as qualification funds," said Robert N. Levin, a Washington, D.C., attorney. Qualification funds are front-end money to set up production facilities, test hardware, etc. The funds would come out of NASA’s budget and could amount to $100 million before beginning work on the first booster.

"But if the hardware is declared to be fixed, and the system is operational, essentially NASA could publish Thiokol's blueprints and ask competitors how much they would charge to build this," said Levin. "NASA would not have to pay qualification funds, because they're asking only the price per copy and not for fundamental R&D.”

"If NASA acknowledged that the booster joint was a major problem, though, that opens the contract window so other competitors can come in and say 'We're entitled to qualification funds. We're not simply building off the Thiokol blueprints now. We're redesigning the seal.’'

But, obedient to the U.S. Competition in Contracting Act, NASA announced on Dec. 26, 1985 — less than a month before Challenger's original launch date — a set of rules under which other manufacturers could bid to become a second source for the boosters. Although the bidding rules favored Thiokol in many ways, the announcement, Levin said, still threatened "a very fat contract... ".

NASA and Thiokol were aware of the likely impact of redesigning the booster joint from the ground up at least six months before Challenger's last flight. On July 23, 1985, NASA budget analyst Richard C. Cook sent a memo to his superior. He wrote that if the cause of the seal problems required a major redesign, it "would lead to the suspension of Shuttle flights, redesign of the SRB (solid-fuel rocket booster), and scrapping of existing stockpiled hardware. The impact on the FY 1987-8 budget could be immense."

Within Thiokol, Boisjoly wrote on July 22, 1985, that the company needed to focus attention on the problem. Otherwise, "We stand in danger of having one of our competitors solve our problem via an unsolicited proposal. This thought is almost as horrifying as having a flight failure before a solution is implemented."

How did NASA and Thiokol view the odds?

"No data conclusively showed that low temperatures would increase the risk," said NASA's Mulloy. "I agree that continually taking that risk was bad judgment, but that started long before the night of Jan 27, and had the highest levels of NASA management participating in it."

According to Thiokol's Kilminster, "Tests that showed lower resiliency of the (primary) O-ring at low temperature did not include the effects of pressure acting on it during the motor-ignition pressure rise. This pressure tended to move it into a seating position," he said. "We felt-based on all the test experience plus flight experience-that pressure caused the O-ring to operate as it was designed to operate even in some of the static tests that were relatively cold — 40º F.”

Mulloy said he argued: “We’ve been addressing this problem of O-ring erosion every launch. What is different this time? Temperature was different. What is the effect of

temperature? Our conclusion was that there is no correlation between low temperature and O-ring erosion — our worst erosion was at one of the highest temperatures.

The Marshall Flight Readiness Reviews were, “an adversarial process... you watch Larry Wear or Larry Mulloy or Thiokol take a whipping... (Dr. Lucas) challenges the technical information.” This created intense preoccupation with procedural conformity and “going by the book” with pressure to achieve the most rigorous data analysis possible. Observational data, backed by an intuitive argument, was unacceptable in NASA’s science-based, positivistic, rule-bound system.

From Diane Vaughan, 1996

"I concluded that we're taking a risk every time," Mulloy said "there was no significant difference in risk from previous launches. We'd be taking the same risk on Jan 28 that we have been ever since we first saw O-ring erosion.”

That data linking low temperature to increased O-ring problems was uncertain may have had an under-appreciated role. "In the face of uncertainty, people's preferences take over," said Dennis Mileti, professor of sociology and director of Colorado State University's Hazards Assessments Laboratory. "The risk is denied, discounted, and the chance is taken. This is not unique. It's just like any of us getting on an airplane — we all know that airplanes crash, but in our hearts we don't believe that the one we get on will crash."

Uncertainty over the affect of cold on the seal came about in several ways. There was no launch-commit criterion for the booster joint with regard to temperature. There was no graph plotting flights, with or without erosion, as a function of temperature that might have enabled the engineers to assess whether or not there was a correlation.

There was also uncertainty over what temperatures had been specified in the design criteria. McDonald and Lund of Thiokol both say that the only specification they knew of called for the booster to operate between 40 and 90º F. But what those limits referred to was unclear: Did it apply to the ambient temperature or to the propellant's mean bulk temperature inside each booster? Thiokol engineers say they never knew of a "higher-level spec," set at Johnson Space Center that called for the entire shuttle system, to function at ambient temperatures from 31 to 99º F.

Mulloy calls that uncertainty "nonsense. Thiokol wrote the end-item specifications”, he said. Nonetheless, everyone at NASA assumed that because specifications did exist, the entire shuttle met them. There also seems to have been confusion over the establishment of launch-commit criteria, as well as over when the criteria could be waived.

“No one either at Thiokol or at NASA knew for sure how the O-rings would respond to cold,” said Mulloy. The Viton rubber O-rings had never been tested below 50º F, mainly because they had been designed to withstand the heat of combustion gases rather than the chill of winter launches. The Viton was formulated to military specifications for use between -30 and +500º F, but NASA did no tests of its own to see whether the O-rings met those specifications.

Even opposition by several Thiokol engineers to sending up the shuttle in freezing weather was not, in itself, seen as sufficient reason to scrub the launch, because experience itself is an uncertain guide. "I don't think there was a single launch where there was some group of subsystem engineers that didn't get up and say 'Don't fly,' " said Hans Mark, now chancellor of the University of Texas system in Austin. "You always have arguments."

What role did NASA's safety office play?

The Rogers commission noted the absence of safety personnel in making the decision to launch Challenger. Arnold Aldrich told the commission there was a lack of problem-reporting requirements, an inaccurate analysis of trends, a misrepresentation of criticality, and a failure to involve NASA's safety office in critical discussions.

Indeed, NASA's own corporate structure contributed to those problems. Safety, reliability, and quality assurance was the responsibility of NASA’s chief engineer, Silveira, in Washington. This headquarters directed 16 field centers and facilities all over the country. According to the Rogers commission, one of the headquarter’s staff of 20 devoted one-quarter of his time to space-shuttle concerns; another spent only one-tenth of his time on flight-safety issues.

“In the early days of the space program we were so damned uncertain of what we were doing that we always got everybody’s opinion,” said Silveira. “We would ask for continual reviews, continual scrutiny by anybody we had respect for, to look at this thing and make sure we were doing it right. As we started to fly the shuttle again and again, I think the system developed false confidence in itself and didn’t do the same thing.”

Was NASA or Thiokol pressured to launch?

The push was on for 15 launches in 1986 and 24 launches a year by 1990.

The House committee report stressed the likely result of such a schedule: “The pressure was so pervasive that it undoubtedly affected attitudes regarding safety. Operating pressures were causing an increase in unsafe practices & shortcuts in launch-preparation procedures to save time.”

The day of the disaster brought speculation about pressure from the White House to have Challenger launched in time for President Reagan’s State of the Union address, scheduled for that evening. NASA officials told the Rogers commission however, that there was no such pressure.

Senator Ernest F. Hollings (D-SC) and Representative James R. Traficant Jr. (D-OH), a member of the House Science and Technology Committee, questioned that conclusion. "Whether or not there was any direct intent to apply pressure …I believe NASA perceived that these types of timetable are important."

In support of Dennis Mileti’s theory that in the face of uncertainty, people opt for their preference, Levin said: “None of the folks that decided to fly Challenger wanted those people to die. We’re not talking about murderers. We’re talking about people who took a risk with other people’s money, other people’s property, other people’s lives – hoping that the good luck that had always attended NASA activities would hold”

Why didn't they talk to each other?

“Dr. Lucas (head of Marshall Space Flight Center) had an authoritarian manner; (T)his autocratic leadership style grew over the years to create an atmosphere of rigid, often fearful conformity among Marshall managers. And under Dr. Lucas, Marshall’s managers began to keep their own counsel, hiding difficulties within the center.”

Malcolm McConnell in Challenger: A Major Malfunction, 1987

The Rogers commission perceived a lack of communication between engineers at Thiokol and the top NASA managers who made the launch decisions. This breakdown meant that no information flowed on known problems with the booster joint – not only during the decision to launch Challenger, but also during the entire design and development process.

Hans Mark, widely regarded for his insight and skill in technology management, has observed: “The only criticism that I have of the [Rogers commission report] is that they laid more blame on the lower level engineers and less blame on the upper-level management than they should have. As with most of those commissions, the guys on the bottom took the rap.”

“They quote [associate administrator for space flight] Moore and [administrator] Beggs saying they didn’t know about the O-ring problems, which I find hard to believe. I mean, hell, I knew about it two years before the accident and even wrote a memo about it. I just find it very hard to believe.”

Roger Boisjoly at Thiokol, Ben Powers at NASA, and other technical people claim they did as much as they felt they could to air concerns, short of risking being fired.

They saw themselves as loyal employees, believing in the chain of command. Boisjoly told the Rogers commission: “I must emphasize, I had my say, and I never take (away) any management right to take the input of an engineer and then make a decision based upon that input … So there was no point in me doing anything any further.”

Powers said: "You don't override your chain of command. My boss was there; I made my position known to him; he did not choose to pursue it. At that point it's up to him." And at least two others, asked why they did not voice their concerns to someone other than their immediate superior, replied: "That would not be my reporting channel."

Harold Finger of the Committee for Energy Awareness warned: "You must organize for multiple lines of communication. You cannot be in a situation limited by the requirement for a single reportage. That's what happened in the shuttle accident. There was no built-in system of multiple communications. When objections were registered to somebody at Marshall or Houston or Kennedy, and he determined it didn't have to go up, it didn't go up."

But even if lower level managers do pass the technical staff's concerns up the chain, they may make crucial modifications. "The fact that people are in a hierarchy tends to amplify misperceptions," said William H. Starbuck, ITT professor of creative management at New York University's Graduate School of Business Administration. "A low-level person has a fear that something might happen and reports it to a higher level. As it goes up the hierarchy, information gets distorted, usually to reflect the interests of the bosses."

How about NASA's past success?

It is human nature to believe that success breeds success, when in some situations success may lead directly to failure. One of those situations is when people feel they have a problem licked. Said NYU'S Starbuck: "As a company is successful, it assumes success is inevitable. NASA had a history of 25 years of doing the impossible.

"My speculation is that this history gave NASA two points of view," Starbuck said. "First, risks presented by engineers are always overstated — the actual risk is much smaller than it appears. Second, there is something magical about this group of people that can somehow surmount these risks. They developed a feeling of invulnerability."

Otto Lerbinger, professor of communications at Boston University, characterized this feeling that nothing can go wrong as "the Titanic syndrome." On the Titanic, he said, everyone felt that safety had been taken care of. "They even felt they didn't need lifeboats for everyone because the ship was unsinkable." Complacency sets in.

“Top administrators must remain in touch with the hazards of their own workplace. Administrators in offices removed from the hands-on risky work are easily beguiled by the myth of infallibility.”

Diane Vaughan, 1997

Starbuck, Lerbinger and Colorado State University's Dennis Mileti all sense that such feelings of invulnerability can lead an organization to take greater chances. Starbuck noted a cut in the number of NASA inspectors assigned to oversee contractor's work, and the decrease in the safety, reliability, and quality assurance staff, disproportionate to other NASA staff cuts over the 15-year shuttle program.

All three noted shaving safety margins to increase shuttle payloads. "You build a bridge and it works, and so on the next one you trim it," said Starbuck. "That exceeds expectations, so you trim a bit more, until you build one that collapses."

John Hodge, retired NASA's associate administrator for space stations, said: "The problem is everybody thinks of engineering as an exact science. One of the real problems at NASA is that the more successful we are, the more people believe it's an exact science — and it isn't. There's a great deal of trade-off on design, and a great deal of judgment involved, and there always will be."

What lessons have been learned?

“Sensitivity to risk is essential in organizations that deal with hazards. Yet collective blindness is also possible in an organization where change is introduced gradually, routinization is necessary to accomplish tasks, problems are numerous, and systems are complex.”

Diane Vaughan, 1996

For Lawrence Mulloy, there are two major lessons to be learned from Challenger. "To assure that a product one sets the specs for and procures is designed, qualified, and certified to meet the design requirements," he said. "The fact that the booster was to function in 31º F ambient temperatures was flat missed. Whether that caused the accident is academic, but the fact was it was missed."

“Second, be very, very careful using subscale tests and analytical techniques to justify operations when the component is not operating as you designed it to operate. Be careful in rationalizing the acceptance of anomalies you didn't expect."

According to Boston University's Lerbinger, corporate cultures try to ignore the unpleasant. This has to be counteracted by deliberately creating a culture that encourages people to bring up unpleasant information. "In a group trying to move ahead with a decision, you find that those people that have anything negative to say are unpopular. So a manager has to encourage people taking the devil's advocate position. Somebody has to think about the possibility of something going wrong, and to use a worst-case scenario approach.”

Erasmus Kioman, retired consultant for the National Academy of Public Administration in Washington, has written six management studies of NASA. "The way to minimize uncertainty is to have an environment where bad news can travel up," he said. "Where there's that, there's trust and confidence."

Time and again there is the tendency to kill the messenger bringing bad news, rather than punish the wrongdoers.

When there is no penalty being careless or doing wrong, the very behavior that should be prevented is actually enforced. Thus penalties have to be clarified and exacted, said attorney Robert Levin. "What I would very much like to come out of all this — legislatively or otherwise — is that the next time this kind of dispute comes up, one of these engineers can say 'Damn it! Look what it cost Thiokol.' Now you're talking the language those folks understand."

Defining terms

Blow-by: passage of gas or debris around an O-ring before It has sealed the joint by moving into its seated position; it may or may not be accompanied by charring or erosion.

Charring: a blackening or slight decomposition of the surface of an O-ring without it necessarily being eaten away; the condition may lead to erosion.

Clevis: a circumferential groove around the upper end of each cylindrical booster case segment that receives the tang of the next segment above; the inner flange has two machined slots in which the O-rings are seated.

Criticality: a NASA hardware categorization that reflects the direct effect of an item's failure on a shuttle mission: Criticality 1 indicates that failure would result in the loss of vehicle and crew; Criticality 2, in the loss of the mission; Criticality 3 covers all other failures; a suffix "R" designates redundancy in any part that has a backup.

Erosion: decomposition, vaporization, or significant eating away of an O-ring's cross-section by combustion gases.

Extrusion: a deformation of the O-rings that pushes into the gap between the tang and clevis, caused by combustion pressure from the motor (this was the mechanism through which the O-ring seals were expected to work).

Factory joint: a Joint between booster case segments assembled at the Thiokol factory near Brigham City, Utah, before shipment to the Kennedy Space Center at Cape Canaveral, Fla.; the joint itself is identical to a field joint, but is covered with insulation so that the propellant can be cast inside it.

Field joint: a joint assembled in the field at the Kennedy Space Center during final erection of the booster.

Flight-readiness reviews: a series of reviews held by NASA and contractor management to ascertain the readiness of a given shuttle system for launch; reviews start many months before a launch and continue up to the day before lift-off.

Interference fit: a fit (as between the segments of a Titan booster) where one of the mating parts is forced into the space provided by the other for maximum contact and overlap.

Joint rotation: a movement of the joint’s tang and inner clevis flange with respect to each other; the movement, which takes place as pressure builds in the boosters at ignition, enlarges the gap the O-rings must seal.

Leakcheck port: a small port leading to the annular cavity between the two O-rings that is pressurized to check whether or not the O-rings are properly sealing the joint.

O-ring: a ring of synthetic Viton rubber, nominally 0.280 inch (71 millimeters) thick and 146 in. (3.7 m) in diameter; two O-rings seal each joint between the booster's segments.

Shims: small, U-shaped clips fitted between the outer clevis flange and the tang of each field joint over the 177 load-bearing pins; the shims maintain the concentricity of the tang and clevis, controlling the squeeze on the O-ring.

Solid-fuel rocket booster: the complete booster comprises the motor, aft skirt, launch support (hold-downs), attach points (between external tank and booster), avionics, instrumentation, range safety systems, separation motors (to jettison the spent booster after two minutes of flight), and drogue and recovery parachutes.

Solid rocket motor: the booster sections that contain the propellant, igniters, thrust vector controls, and nozzle.

Static test: a test in which the booster is ignited in a horizontal position; the test does not, however, emulate the dynamic loads of flight.

Tang: a circumferential tongue on the lower rim of the upper segment at each joint on the booster, and fitting between the flanges of the clevis on the segment below.

Figure 1: The Launch Decision Chain, Flight Readiness Reviews (FRR’s)

[pic]

The shuttle’s launch-decision chain had four management levels, each of which in succession approved a launch. Positions shown are those occupied at the time of the Challenger launch. Under this system, only open items (i.e., those not resolved) were reported to the next higher FRR level. Therefore, once Morton-Thiokol approved the launch the night of Jan 27, 1986 and this position was accepted by NASA managers, the O-rings were considered a closed item and were not carried forward to the next FRR level.

Figure 2: Anatomy Of A Booster Field Joint

[pic]

T.E.B. and K.E.

Figure 3: Joint Rotation

[pic]

Figure 4: Titan Joints vs. Shuttle Booster Joints

[pic]

-T.E.B. and K.E.

Figure 5: Joint Putty

[pic]

The zinc chromate putty was used to insulate the O-rings from hot combustion gases (A) Combustion pressure displaced the putty, compressing air against the primary O-ring, forcing it into the gap. After assembly, the seals were checked by pressurizing the space between the O-rings through a leak-check port (B) The test seated the secondary seal downward but drove the primary seal upward, away from its sealing position. Because the putty could mask a leaking primary seal, the pressure of the leak-check test was increased from 50 psi, first to 100 psi then to 200 psi-pressure guaranteed to blow a hole through the putty. Upon ignition (C), the joint rotated open and combustion gases came through the blowholes and pushed the primary O-ring into its sealing position. But the same blowholes allowed hot gases to impinge on the O-ring, eroding it until the seal was seated and pressure equalized. This was seen as more acceptable than the possibility that the O-rings would not seal at all.

Figure 6: O-Ring Distress

[pic]

The distress suffered by O-rings in the booster field joints can be related to leak-check test pressure. Though these joints received more attention, the nozzle joints showed twice as many problems, increasing in number and severity along with increases in the leak-check pressure. From flight STS 41-B, pressure went to 200 psi for field joints and 100psi for nozzle joints - which also went to 200 psi for STS 51-D. (R stands for right booster and L for left.)

Figure 7: Joint Distress vs. Temperature At Launch

[pic]

Distress to O-rings is plotted against calculated temperature of the joints at launch. Thermal distress is defined as erosion, blow-by, or excessive heating. While on the whole, the higher the temperature, the fewer the problems, that correlation was by no means absolute. At the time there were doubts whether such a correlation existed at all. NOTE: This graph was not available to those participating in the conference call the night of January 27, 1986.

Figure 8: 7/31/85 Memo, Boisjoly

[pic]

Figure 9: 10/1/85 Memo, Ebeling

[pic]

[pic]

Figure 10: 10/1/85 Memo, Stein

[pic]

Figure 11: 10/4/85 Activity Report, Boisjoly

[pic]

[pic]

Acknowledgements

In addition to sources named and unnamed, the authors want to express appreciation to: John F. Clark, former director of NASA’s Goddard Space Flight Center, Greenbelt. Md.; Bill D. Colvin, NASA’s inspector General; Philip E. Culbertson, NASA's general manager; John M. Logsdon, director of the graduate program in science, technology and public policy at George Washington University, Washington. DC; George A. Rodney, NASA associate administrator for safety, reliability, maintainability and quality assurance; Julian Scheer, former director of NASA’s public affairs; Richard Smith, former director of NASA's Kennedy Space Center; and Spectrum associate editor Elizabeth Corcoran and Paul Wallach for their insightful discussions and assistance.

The authors tried to reach anyone who had significant influence on NASA’s decision to launch Challenger. Of the launch-decision chain, only Joe C. Kilminster and Lawrence B. Mulloy agreed to be interviewed, Mulloy in particular being generous with his time. Stanley R. Reinartz, Jesse W. Moore and William R. Lucas did not return telephone calls or respond to the manuscript sent to them. Arnold 0. Aldrich refused to discuss the past: William R. Graham, NASA's acting administrator at the time of the Challenger accident, refused to be interviewed. Of the Rogers commission members. Joseph Sutter was very helpful; Chairman William B. Rogers and member's Sally Ride and Richard P. Feynman declined to be interviewed.

[1] The article was written in 1987. Pull quotes (shaded text) generally represent richer and more recent analysis of the facts of the case.

[2] Shaded text printing as all black? To correct, within Word select “Tools, Options, Compatibility”, then deselect “Print colors as black on noncolor printers.”

[i] Permission to copy without fee all or part of this material is granted provided that the copies are not made or distributed for direct commercial advantage, the IEEE copyright notice and the title of the publication and its date appear, and notice is given that copying is by permission of the Institute of Electrical and Electronics Engineers. (445 Hoes Lane. PO Box 1331. Piscataway, NJ 08855. (908) 562-3966 or (212) 705-7900.) To copy otherwise, or to republish, requires a fee and specific permission.

[ii] Edited for brevity and content correction. Shaded quotes and Morton-Thiokol documents have been added.

-----------------------

Last Updated 3/30/2004

Shown is a cross section of one of the field joints between segments of the solid-fuel rocket boosters. The tang projecting from the lower edge of each upper segment fits into the 3¾-inch deep clevis in the upper rim of the segment below. Tang and clevis are locked together by 177 1-inch steel pins around each joint, secured by a steel band encircling the joint, and protected from aerodynamic heating by a layer of insulating cork.

The two O-rings, running in grooves around the clevis's inner flange, seal each joint against the pressure (about 1000 psi at peak of ignition, at some 5800º F) of hot gases from the burning propellant inside the booster. The O-rings are just over ¼ inch (nominally 0.260 inch or 7.1 millimeters) in section diameter. Made of black Viton rubber, they have the appearance, texture, and resilience of a somewhat stiff rope of licorice.

Pea-soup green strips of an asbestos-filled, zinc chromate putty protect the O-rings from direct exposure to the hot propellant gases. The putty's consistency varies from tacky to stiff, depending on ambient temperature and humidity.

One leak-check port at each joint allows the O-ring seals’ integrity to be tested as the segments are stacked during assembly, usually several weeks before a launch. Insulation protects the half-inch steel walls of the rocket casing from solid propellant, which looks and feels like a pink pencil eraser.

The joint's critical sealing surfaces are where the O-rings are designed to seal the joint upon pressure from the rocket's ignition, pressing onto the tang-and-clevis surfaces and extruding downward into the gap between tang and clevis. The pressure is brought to bear on the O-rings through the putty, which acts as piston as well as thermal barrier. To ensure a proper squeeze on the O-rings in their grooves and to minimize gas blow-by at ignition, thin metal shims were added between the tang and the clevis's outer flange.

Before ignition, the booster's walls are vertical and both O-rings in any joint are in contact with the tang (A). Upon ignition, internal pressure of some 1000 pounds per square inch swells each booster section 's case by 1-1/2 inches circumferentially. Because the joints are stiffer than the case as a whole, each section bulges a little so that its shape can be compared to that of a frozen can of soda. The swelling causes the joint to rotate (B), so that the primary O-ring is pushed into the gap between tang and clevis, and the secondary O-ring is lifted altogether from its sealing surface against the tang. Such joint rotation may eliminate the secondary O-ring's effectiveness as a redundant seal. (Rotation in the sketch is exaggerated).

The Air Force's Titan III segmented solid-fuel rocket inspired the Thiokol design for field joints on the space shuttle booster (right). In both joints, a tang on the rim of one segment slips into a clevis on the rim of the next, and the two segments are fastened together by pins.

Differences between the two applications include:
• While the Titan joint has one O-ring, the shuttle's joint has two — a redundancy that left NASA and Thiokol confident that one, at least, would seal.
• The shuttle's field joint, with the clevis pointing upward, is upside down compared with the Titan joint. There were suspicions after the Challenger disaster that rainwater seeping between the outer flange could have frozen and prevented the O-rings from sealing.
• At the Titan joints, the insulation of one segment fits tightly against the insulation of the next, forming a better seal than the booster joint's putty.
• The shuttle booster's tang is longer than on the Titan, more susceptible to bend under the combustion pressure
• The pressure of combustion in the shuttle booster joint is nearly 1000 pounds per square inch, one third again as high as the Titan's 750 lb/in.2.
• The shuttle booster segments, with their joints, were designed to be reused, unlike those of the Titan.